9 - 2023 03 28 IA reports issued
North Ayrshire Council · 28 March 2023
Back to Audit and Scrutiny Committee — 28 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 28 March 2023 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between January and February 2023. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between January and February 2023. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from two separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below:
Page 2
Audit Title Assurance Level Financial Controls within ASN and Primary Schools Reasonable Social Care Establishments Reasonable 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between January and February 2023. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within the Council Plan 2019-2024. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Laura Miller, Senior Manager (Audit, Fraud, Safety and Risk), on 01294 324524. Background Papers None.
Page 4
FINANCIAL CONTROLS WITHIN ASN AND PRIMARY SCHOOLS 1 Background 1.1 This audit was performed by requiring all schools to complete a self-assessment questionnaire and provide supporting documentation. Each response was reviewed in detail and followed up as necessary. In addition, a sample of schools were visited to allow more detailed audit testing to be performed. 2 Objectives and Scope 2.1 The objective of this audit was to review financial controls within the Council’s ASN and primary schools. The questionnaire and detailed testing were designed to gain assurance that:- • Staff are aware of all relevant Council governance procedures. • All cash is being held securely and is being properly managed. • Cash withdrawals made via the Procurement Card are being used for appropriate types of expenditure, and all transactions are being properly recorded. • A full audit trail exists for all school fund income and expenditure transactions. • Processes are in place to ensure PEF spend is maximised. 3 Findings Governance 3.1 Head Teachers were asked to confirm they were aware of a number of key Council policies and had completed a number of key training courses. The majority of Head Teachers gave full assurance. Those who didn’t were asked to familiarise themselves with the policies and complete any outstanding training as soon as possible. 3.2 Schools were asked to confirm if all relevant officers have completed cash handling training. The majority of officers have, and those who haven’t are on the waiting list for the training. 3.3 Finally, schools were asked to confirm that all relevant officers have completed fire warden training. The majority of officers have completed the training. Those who haven’t have been directed to the Council’s online training course which is available for immediate completion. Cash Holding 3.4 A cashless catering system (iPayimpact) is in operation in all ASN and primary schools. Schools can also use this system to collect payments for other items such as school trips, school uniform, fundraising etc. 3.5 The ability to accept payments online has reduced, but not eliminated, cash in schools.
Page 5
3.6 There is a risk associated with holding cash, therefore schools were asked to confirm:- • The arrangements in place for the safe storage of cash • That they are aware of the maximum insurable value of cash held within the school • Keyholder registers are up to date. Schools were also asked to provide copies of these 3.7 No issues were noted regarding cash storage locations, and schools confirmed they were aware of insurable limits. 3.8 Audit liaised with a number of schools to clarify and/or expand their keyholder registers. Updated registers have been provided by all these schools. GPC Cash Withdrawals 3.9 Officers can withdraw cash using their procurement cards IF this facility has been activated on their card. 3.10 Only 5 schools have cardholders with this facility activated. 3.11 Audit reviewed GPC cash expenditure from 1 April 22 to 31 December 22. During this period only 2 schools have used GPC cash – with transactions totalling £189.33. 3.12 Audit reviewed the cash transactions to ensure the expenditure type seemed reasonable – no issues were noted. Due to the minimal volume and value of transactions, no further detailed testing has been undertaken. School Funds 3.13 Council procedures state that school fund accounts must be audited annually by an independent party. 3.14 These audit reports give assurance that detailed and accurate records are being kept of school fund transactions. 3.15 Schools must have accounts audited and a copy submitted to Education HQ by 30th November. As of 31 December 22, 3 schools have indicated that their accounts have not yet been audited. 3.16 Education HQ has confirmed that a direct instruction has been sent to those who have failed to meet the deadline. 3.17 During site visits it became evident that, at times, school fund expenditure is being authorised verbally. This means there is no audit trail available to confirm who/when/if expenditure has been approved. 3.18 Audit has spoken directly to the Head Teachers in the schools where this issue was witnessed. (action point a) Inventory
Page 6
3.19 The Council’s Inventory procedure states that all establishments must maintain detailed inventory records which are updated throughout the year to reflect purchases, disposals and movements of assets. Updates should not be restricted to annually for the year end. 3.20 Head Teachers complete an ‘Annual Inventory Certificate’ in which they confirm that inventories are being maintained on a continuous basis. Whilst Head Teachers were instructed to return a copy of this certificate to Education HQ, not all complied. (action point b) 3.21 In addition to ensuring compliance with Council procedures, detailed inventory records are essential for Insurance purposes – in order to prove an item is an ‘insurable asset’ it must be recorded on an establishment’s inventory record. 3.22 Schools were asked to confirm the date that their inventories were last updated and provide copies of all detailed inventory records. 3.23 The information supplied highlighted that not all schools have updated their inventories recently – with several quoting 2021 for the last update. (action point c) 3.24 Audit noted that the level of detail being recorded for IT assets varies between schools. Not all IT records are sufficiently detailed to allow specific assets to be clearly identified. (action point d) PEF 3.25 Head Teachers are responsible for PEF spend. 3.26 Audit obtained copies of the monthly PEF monitoring reports provided by Education HQ to support Head Teachers in this role. 3.27 These reports contain detailed staffing projections along with information on all other actual spend to date. 3.28 Audit deemed these reports sufficient to support Head Teachers. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard the areas of financial control reviewed during the Audit.
Page 7
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 8
KEY FINDINGS AND ACTION PLAN FINANCIAL CONTROLS WITHIN ASN AND PRIMARY SCHOOLS Action a Finding Incomplete audit trail for school fund transactions. Action Description Education HQ to remind all Head Teachers/Heads of Centres of the importance of ensuring a detailed audit trail is available for all school/early years fund transactions. There should always be clear written evidence of a transaction having been authorised. Risk Misappropriation of school funds; failure to comply with the Council’s school funds procedures Priority (1, 2, 3) 2 Paragraph Reference 3.18 Managed by Andrew Mcclelland, Head of Service Assigned to Lynn Taylor, Senior Manager Due Date 31 March 2023 Management Comment A reminder will be issued by the Head of Service to remind all Head Teachers/Heads of Centres of the importance of ensuring a detailed audit trail is available for all school fund transactions. Action b Finding The Council’s Inventory Procedure requires establishments to submit signed copies of Annual Inventory Certificates to Headquarters. These certificates then support the completion of the Annual Composite Certificate for the Service. Whilst Primary School Head Teachers are completing the Annual Certificates and retaining these on site, they are not being required to submit these to Education HQ. Action Description All Head Teachers should be instructed to submit signed Annual Inventory Certificates to a nominated Education HQ officer. This officer should ensure all schools submit returns timeously. Risk Non-compliance with Council Procedures Priority (1, 2, 3) 2 Paragraph Reference 3.20 Managed by Andrew Mcclelland, Head of Service Assigned to Lynn Taylor, Senior Manager Due Date 31 March 2023 Management Comment A communication will be issued by the Head of Service to remind Head Teacher/Heads of Centres to submit signed Annual Inventory Certificates to a nominated Education HQ officer. HQ will ensure all schools submit returns timeously.
Page 9
Action c Finding Not all school inventories have been updated recently. Action Description Education HQ to remind all Head Teachers of the importance of updating inventory records as soon as a change in assets occurs. This ensures that the inventory remains an exact reflection of every asset within the school. Regular spot checks should be undertaken by Education HQ to ensure that inventory records are being maintained. This ensures all records are sufficient to support an Insurance claim if required, but also ensures that Annual Inventory Certificates are accurate. Risk Loss or theft of assets going unnoticed due to schools losing track of the movement of assets; insufficient records to make a claim against the Council’s insurance policy. Priority (1, 2, 3) 2 Paragraph Reference 3.23 Managed by Andrew Mcclelland, Head of Service Assigned to Lynn Taylor, Senior Manager Due Date 31 March 2023 Management Comment A communication from the HOS will be sent to remind all Head Teachers/Heads of Centres of the importance of updating inventory records as soon as a change in assets occurs. This ensures that the inventory remains an exact reflection of every asset within the school. Head Teachers/Heads of Centres will also be reminded of the need for their establishment responsible officer to carry out random, period checks of the inventory records. This will ensure all records are sufficient to support an Insurance claim if required, but will also ensure that Annual Inventory Certificates are accurate.
Page 10
Action d Finding Not all IT inventories contain sufficient information to allow specific assets to be clearly identified. Action Description Education HQ to remind all Head Teachers of the minimum level of detail required to be included in all inventories, but in particular IT inventories. Consideration should be given to providing templates for schools to record inventories on. This would ensure a consistent approach with all schools recording the same level of information for each category of asset. Risk Loss or theft of assets going unnoticed due to schools losing track of the movement of assets; insufficient records to make a claim against the Council’s insurance policy. Priority (1, 2, 3) 1 Paragraph Reference 3.24 Managed by Andrew Mcclelland, Head of Service Assigned to Lynn Taylor, Senior Manager Due Date 31 March 2023 Management Comment A communication will be sent to remind all Head Teachers/Heads of Centre of the Inventory Template Forms (IRF1) and (IRF2) that require to be maintained to provide relevant details of all assets located within establishments. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.
Page 11
SOCIAL CARE ESTABLISHMENTS 1 Background 1.1 This audit was conducted as part of the approved 2022/23 Internal Audit Plan and reviewed financial and other controls within a sample of operational establishments within the Health and Social Care Partnership (HSCP). Five HSCP establishments were visited as part of this audit namely, one of the Children’s Houses, a Day Care and Resource Centre, Community Based Services, a residential Care Home and an Area Team. 1.2 Questionnaires were issued to 31 establishments providing a wider perspective of financial and other controls. 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure: • All cash and income is properly accounted for and held securely; • Income and expenditure relating to independent funds is recorded in line with procedures; • Petty cash purchases are valid, authorised and properly accounted for in line with procedures; • Service User accounts are properly accounted for in accordance with departmental policy; • Purchases made via procurement card or E-procurement are valid, authorised and administered in line with procedures; • Staff are complying with the Council’s Financial Regulations and other financial instructions; • Asset management is properly conducted and administered in line with procedures. 3 Findings Policy and Procedures 3.1 Policy-related questionnaire responses indicated a general awareness of key financial and IT policies. This was confirmed at all locations visited. 3.2 Questionnaire responses relating to awareness of contract policies, highlighted gaps in awareness of the maximum amount of cash which may be held on their premises, and attendance at the Council’s training courses on both financial regulations and cash handling. This is reflective of considerable pressures experienced by the service provision and change of management within individual establishments. (action a) Cash Holding and Security 3.3 Two questionnaire responders confirmed that they had no cash on the premises, other responses confirmed different sources of money were held separately and access was restricted to those who had legitimate need. The typical amounts of cash per premises ranged from £100 to £6,000 depending on client requirements.
Page 12
3.4 Site visits confirmed that cash was kept in a secure location with access restricted to only those responsible for cash. Different funds were locked in separate cash tins and client funds were kept in separate pouches. Cash Handling 3.5 Depending on the site, cash reconciliations were completed on shift changeover, or in offices which had no shift handover daily. 3.6 A complete cash check of petty cash and client cash was carried out in each of the establishments visited. No discrepancies were identified. 3.7 Petty cash purchases were recorded on a Microsoft Excel template in 3 of the establishments visited and on a manual card for 2 of the sites visited. In each establishment, petty cash purchases were audited and confirmed to be accurately recorded and valid with supporting receipts. 3.8 One establishment visited provided shop vouchers for clients. These were properly secured and accounted for. 3.9 All third-party funds were accurately recorded and individually stored in individual envelopes or pouches. In one establishment visited, staff reported a concern with handing clients funds in a busy reception area. (action b) 3.10 No bank books were located within the establishments visited. Inventories 3.11 The questionnaire responses indicated that 16 establishments did not have an up-to-date inventory. Lists of items under warranty are maintained by 4 establishments. Site visits confirmed that 2 establishments had up-to-date inventory lists and the other 3 had inventories but had not kept them up-to-date. (action c) GPC Cards 3.12 All cards were reported to be secure in the questionnaire which was confirmed at the site visits. 3.13 All the cash handling establishments reported in the questionnaire that they used the GPC card for withdrawing cash. Site visits confirmed the process for collecting cash was carried out in a secure manner, including an irregular pattern. 3.14 A random sample of GPC card transactions for each of the establishments visited was tested for procurement compliance. No issues were identified. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regard to security and handling cash.
Page 13
4.2 Lack of policy knowledge and attendance at financial and cash training courses is reflective of change of managers and newness of some establishments. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 14
KEY FINDINGS AND ACTION PLAN SOCIAL CARE ESTABLISHMENTS Action a Finding Not all managers have completed financial procedure and cash handling training. Action Description In light of current pressures, a guidance booklet be established to provide guidance to new managers and a long- term training strategy be established which ensure training is completed in line with HSCP’s operational needs. Risk Managers are unaware of their responsibilities and processes become localised and inconsistent with NAC corporate policy. Priority (1, 2, 3) 1 Paragraph Reference 3.2 Managed by Julie Davis, Principal Manager (Business Administration) Assigned to Lynne Ferguson, Business Admin Manager Due Date 31/05/2023 Management Comment We will implement a process to ensure that all relevant staff undertake financial regulations and cash handling training where appropriate. This will involve running reports from the e-learning system on a regular basis and liaising with senior managers to ensure their staff complete the training. Action b Finding Clients’ cash is distributed in a public domain Action Description In establishments where client cash is being distributed an independent review of locations used is completed and a procedure established. Risk The potential risk of targeted fraud or theft. Priority (1, 2, 3) 1 Paragraph Reference 3.9 Managed by Julie Davis, Principal Manager (Business Administration) Assigned to June Mclennan, Centre Co-ordinator Due Date Complete Management Comment This has now been addressed at the location which was visited by Internal Audit and a closed office has been allocated for the distribution of cash to clients. At other locations, cash is handled either behind screens or in a closed office.
Page 15
Action c Finding Asset inventories are incomplete and not maintained to reflect current estate. Action Description Asset registers are to be brought up to date. Risk Items are not properly valued, new items are not registered and missing assets not identified. Assets are not covered by the Council’s insurance policy. Priority (1, 2, 3) 1 Paragraph Reference 3.11 Managed by Julie Davis, Principal Manager (Business Administration) Assigned to Julie Davis, Principal Manager (Business Administration) Due Date 30/04/2023 Management Comment An email has been sent to all establishments instructing them to bring their inventories up-to-date and this will be completed and checked in line with financial year-end requirements. Priority Key used in Action Plan 1 (High) Control weakness where there is a material impact on the achievement of the control objectives, generally requiring prompt attention. 2 (Medium) Control weakness which needs to be rectified, but where there is no material impact on the achievement of the control objectives. 3 (Low) Minor weakness or points for improvement.